More than half of UK businesses lack confidence in basic cyber skills
Government survey puts the figure at 808k, says detecting and removing malware most common weakness
A recent government survey reveals that over half of the UK's businesses lack confidence in their ability to handle fundamental cybersecurity tasks. The annual study shows a 8 percentage point increase in businesses reporting a technical skills gap, from 49% last year to 57% in the current year. This translates to approximately 808,000 companies whose cybersecurity leaders are unsure about completing at least one of nine essential tasks, such as securing data storage, configuring firewalls, and detecting malware.
The largest reported skills gap is in malware detection and removal, with 38% of businesses, 47% of charities, and 23% of public sector organizations lacking confidence in this area. Public sector organizations, however, reported fewer issues across all nine basic skills measured. Sam Thornton, COO at cybersecurity consultancy Bridewell, suggests that the figures reflect the situation of smaller businesses and charities, where cybersecurity is often just one part of someone's broader role rather than a dedicated job.
He notes that malware is rapidly evolving, and AI is making attacks harder to detect, requiring constant attention from personnel. Matt Hull, VP of cyber intelligence and response at NCC Group, points out that limited resources and complex IT environments, including cloud infrastructure, SaaS platforms, and third-party dependencies, contribute to the problem.
He emphasizes the importance of focusing on fundamental security practices rather than chasing the latest technologies. The survey also reveals a concerning increase in the overall basic skills gap, from 14% last year to 27% in the current year, despite repeated warnings about weaknesses in government systems. The UK government's £210 million Cyber Action Plan aims to strengthen central government systems and introduce mandatory security requirements, while operators of critical services can use the NCSC's Cyber Assessment Framework to evaluate their resilience.
However, Thornton argues that tighter regulation alone is unlikely to address the skills gaps among small businesses and charities without providing practical support tailored to their limited resources.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
